How can I retrieve another field value from dashbo...

tamduong16 · ‎08-15-2018

I have an index which consists of 2 fields: name and id. When I created the dropdown, I made it base of name since it is easier for user to identify. But I really need the id as an input for my other searches. I thought I could achieve this by field for label and field for value but it doesn't work. What can I do to get the value of id but doesn't have to create a join for all of my other searches, since I already have a join in my search?

niketn · ‎08-26-2018

@tamduong16, do you mean to say that your query for dropdown has Name but not id? Even if you currently already have join in your existing search but it does not return Id field values, it would be of no use. Your query would need to return both fields so that Name can be used as Label and Id can be used as Value.

If Name and ID exist in the same index, in order for community members to assist you would need to provide your existing query? Your sample data with Name and Ids respectively (also their field names). And also the correlation between the two fields.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

renjith_nair · ‎08-25-2018

@tamduong16,

field for label and field for value works in this case. Please find below the sample xml

Here I have created 5 sample values with id and name and displayed name in the dropdown and the token is set to corresponding id and then i could use the id token in other searches

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="id">
      <label>Name</label>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>id</fieldForValue>
      <search>
        <query>| makeresults |eval ids="1,2,3,4,5"|eval names="A,B,C,D,E"| makemv delim="," ids|makemv delim="," names
|eval z=mvzip(ids,names)|table z| mvexpand z|eval x=split(z,",")|eval id=mvindex(x,0),name=mvindex(x,1)|table id,name</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <default>1</default>
      <initialValue>1</initialValue>
    </input>
  </fieldset>
  <row>
    <html>
      <h1 align="center"> Selected id is <font color="red">$id$</font></h1>
    </html>
  </row>
</form>

---
What goes around comes around. If it helps, hit it with Karma 🙂

How can I retrieve another field value from dashboard dropdown?

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

.conf24 | Personalize your .conf experience with Learning Paths!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...